[Snyk] Fix for 4 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

  • package.json

• Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
  Find out more.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Issue	Breaking Change	Exploit Maturity
	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOCHA-561476	Yes	No Known Exploit
	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept

Commit messages

Package name: mocha

The new version differs by 250 commits.

• eb781e2 Release v6.2.3
• 10dbe94 update CHANGELOG for v6.2.3 [ci skip]
• 848d6fb security: update mkdirp, yargs, yargs-parser
• 843a322 6.2.2
• aec8b02 update CHANGELOG for v6.2.2 [ci skip]
• 7a8b95a npm audit fixes
• cebddf2 Improve reporter documentation for mocha in browser. (#4026)
• 3f7b987 uncaughtException: report more than one exception per test (#4033)
• ee82d38 modify alt text of image from Backers to Sponsors inside Sponsors section in Readme (#4046)
• e9c036c special-case parsing of "require" in unparseNodeArgs(); closes #4035 (#4063)
• 954cf0b Fix HTMLCollection iteration to make unhide function work as expected (#4051)
• 816dc27 uncaughtException: fix double EVENT_RUN_END events (#4025)
• 9650d3f add OpenJS Foundation logo to website (#4008)
• f04b81d Adopt the OpenJSF Code of Conduct (#3971)
• aca8895 Add link checking to docs build step (#3972)
• ef6c820 Release v6.2.1
• 9524978 updated CHANGELOG for v6.2.1 [ci skip]
• dfdb8b3 Update yargs to v13.3.0 (#3986)
• 18ad1c1 treat '--require esm' as Node option (#3983)
• fcffd5a Update yargs-unparser to v1.6.0 (#3984)
• ad4860e Remove extraGlobals() (#3970)
• b269ad0 Clarify effect of .skip() (#3947)
• 1e6cf3b Add Matomo to website (#3765)
• 91b3a54 fix style on mochajs.org (#3886)

See the full diff

Package name: nyc

The new version differs by 48 commits.

• e21721a chore(release): 14.0.0
• 8cf8a89 docs: update issue template [skip ci] (#1008)
• d7a9d6a chore: Update package-lock.json
• 189bae8 chore: Update dependencies for 14.0.0-rc.1
• 2eb13c6 feat: instrument `--complete-copy` implementation (#1056)
• c88a852 docs: `nyc instrument` and `--exclude-node-modules` (#1039)
• c213469 feat: always build the processinfo temp dir (#1061)
• e597c46 feat: Add support for --exclude-node-modules to subcommands. (#1053)
• 8dcf180 feat: add processinfo index, add externalId (#1055)
• 32f75b0 fix: set processinfo pid/ppid to actual numbers (#1057)
• 16d4315 chore: Stop excluding `bin` from coverage results. (#1060)
• b909575 fix: Use a single instance of nyc for all actions of main command. (#1059)
• 997ed29 chore: Remove arrify dependency. (#1058)
• 68d6333 docs: move setup docs out of the readme [skip ci] (#1052)
• 8da097e feat: add `include` and `exclude` options to instrument command (#1007)
• 31817de chore: Update dependencies (#1050)
• 18e04ba fix: make --all work for transpiled code (#1047)
• b7e16cd feat: Support turning off node_modules default exclude via flag (#912)
• 3eb0e37 docs: A bunch of docs fix-ups (#1038)
• 5c1eb38 test(instrument): should return unmodified source if no transform found (#1036)
• 1f6c3d4 docs: project root directory and `--cwd` doc (#1032)
• 051d95a fix: Add `cwd` option to instrument command (#1024)
• 91e02c6 chore: A few code cleanups (#1033)
• 2867538 feat: Rename `plugins` option to `parser-plugins`. (#1031)

See the full diff

With a Snyk patch:

Severity	Issue	Exploit Maturity
	Prototype Pollution SNYK-JS-LODASH-567746	Proof of Concept

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:

🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic